Newsroom Update

Beginning in May, a special Today at Apple series titled “Made for Business” will offer small business owners and entrepreneurs free opportunities to learn how Apple products and services can support their growth and success. Learn more >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

User profile for user: Dudeland
Dudeland Author
User level: Level 1
0 points

Using the Keychain Application on a Remote Machine

When accessing a remote machine running OS X 10.11.1, is it possible to modify keychain items via the Keychain application? It was possible, and greatly appreciated, in previous versions of OS X.


Attempting to show passwords on a remote user's machine does not work, logging:

Ignoring user action since the dialog has received events from an untrusted source.


According to Apple's release notes for Security Update 2015-007 (https://support.apple.com/en-us/HT205375), under the last section for SecurityAgent (CVE-2015-5943) it states:


Impact: A malicious application can programmatically control keychain access prompts

Description: A method existed for applications to create synthetic clicks on keychain prompts. This was addressed by disabling synthetic clicks for keychain access windows.


This appears to have disabled keychain modification with the Keychain application on remote machines. As suggested by this post to AskDifferent (http://apple.stackexchange.com/questions/212622/keychain-wont-let-copy-passwords -after-10-11-1-update), granting access to an application via System Preferences -> Security & Privacy -> Accessibility will solve the problem. However, adding ARDAgent to this list does not fix the problem. Also, the remote management daemons in /System/Library/CoreServices/RemoteManagement cannot be added as ScreensharingAgent and screensharingd are located respectively inside of ScreensharingAgent.bundle and screensharingd.bundle, which are not recognized by the System Preference's Security & Privacy panel.


Attempting to use the security command line tool causes similar issues. For example, attempting to display a password with the -g option creates a dialog on the remote machine asking for keychain access permission. As with accessing keychain items from the Keychain application directly on the remote machine, clicking the dialog's "Allow" button will not work.


As my users have a variety of passwords and notes in their keychains, I wish to avoid granting the Keychain application access to every keychain item. I would like the ability to add, modify and delete keychain items via the Keychain application, as I did in prior versions of OS X.

Any help would be gratefully appreciated. Thank you.

Remote Desktop 3.8-OTHER, OS X El Capitan (10.11.1)

Posted on Oct 31, 2015 11:58 PM

Reply
9 replies
User profile for user: Dudeland
Dudeland Author
User level: Level 1
0 points

Nov 1, 2015 3:07 AM in response to Dudeland

I have attempted to generate events for the Keychain Access application from an application approved in the System Preference's Security & Privacy panel. However, those events are ignored.


On my machine, not a remote machine, I created a simple AppleScript to feed events to Keychain Access. I then approved that AppleScript application and the AppleScript Editor in the Security & Privacy panel. However, attempting to activate the Allow button of a show password dialog in Keychain Access via a mouse-down or key-down event generated the same behavior and log messages I encountered while attempting to use Keychain Access on a remote machine.


As another experiment, I granted computer control to Accessibility Inspector and attempted to use the on-screen keyboard available from the Switch Control of the Accessibility system preference. Surprisingly, this gave me the same results as my AppleScript application.


No application appears capable of generating events for any Keychain Access dialogs, even if approved for computer control.

Reply
User profile for user: Rmartell
Rmartell
User level: Level 1
0 points

Nov 25, 2015 12:08 PM in response to Dudeland

I have this problem too.


I had to upgrade to El Capitan because Bots weren't working properly in the Xcode Server build (and googling around said upgrading would fix the problem).


Upgrading DID fix that problem, but basically broke the system entirely, because I can't import my signing credentials into the System keychain, because I can't click on Accept or Accept All. So essentially my OS X server (which is remotely hosted) is now useless.


I understand Apple did what they did, but I need a solution for this very valid use case.

Reply
User profile for user: erikv
erikv
User level: Level 1
29 points

Dec 2, 2015 9:00 AM in response to Rmartell

I can confirm this behavior as I just attempted to install Office 365 apps on a remote machine via ARD. I was able to authorize the first app during the install process, but subsequent Office apps wanted access to the keychain item and no amount of clicking remotely could get it to work. I physically went to the machine and clicked the mouse attached and it worked.


This is a huge show stopper for rolling out Office 365 to our users. ARD is basically worthless now as an admin tool for user workstations. It's even more useless for remotely located servers which don't even have keyboards/mice attached to them.

Reply
User profile for user: peejarupb
peejarupb
User level: Level 1
0 points

Dec 2, 2015 9:13 AM in response to Dudeland

I'm not sure if this will help anyone, but in my case (using a bunch of mac minis as jenkins build agents to create ios adhoc builds and sign with the appropriate adhoc certificate), I was able to:


(on the computer itself)


- open up keychain assisstant

- navigate to the private key which is used to sign the various certificates

- do a Get Info

- set the key to allow all applications to access it

- click the ok/allow button


Now any certificate that needs the private key to sign will automatically have permission to do so. Sure there are security issues with this solution, but in my case all the hardware is behind multiple firewalls so I figure the risk is pretty minimal.

Reply
User profile for user: erikv
erikv
User level: Level 1
29 points

Dec 2, 2015 11:17 AM in response to peejarupb

FYI: I did open a support ticket with Apple regarding this issue.


Furthermore, local mouse clicks on a keychain access dialog will not register if an ARD session is currently active either. You have to disconnect the ARD session, then the local user can click on allow.


Warning: if the client machine has screen lock enabled (i.e. "Require password after ... sleep or screen saver" is checked in Security & Privacy > General) you can end up locking out the end user even AFTER disconnecting the ARD session.


I had this exact situation happen when on the phone with Apple Support. The lock screen would not accept any keyboard/mouse input. A remote "restart" had to be issued via ARD (yes, the end user would have lost all unsaved work). There was a keychain dialog box up on the screen when the ARD session was terminated, not sure if that is what caused the lockout.

Reply

Using the Keychain Application on a Remote Machine

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.
Learn more Sign up